Remove hmac-ripemd160 from RHEL OpenSCAP SSH MAC value selectors - #15070
Conversation
…for OpenSCAP remediation hmac-ripemd160 is not supported by the affected RHEL OpenSSH implementation. The default selector is an allow-list, so remediation writes the unsupported MAC into sshd_config and sshd fails with "Bad SSH2 mac spec". Remove the algorithm from the default selector and from the cis_rhel8/9/10 deny-lists.
|
Hi @phatkamk-lang. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
This is a RHEL-only change to sshd_strong_macs (default + cis_rhel8/9/10). |
jan-cerny
left a comment
jan-cerny
left a comment
There was a problem hiding this comment.
Makes sense. The hmac-ripemd160 MAC was removed from OpenSSH long time ago. https://www.openssh.org/txt/release-7.6 Notice that the rule sshd_use_strong_macs that uses this variable isn’t currently selected in any RHEL profile.
2 participants
Description:
hmac-ripemd160from thesshd_strong_macsdefault allow-list.hmac-ripemd160andhmac-ripemd160-etm@openssh.comfromcis_rhel8,cis_rhel9, andcis_rhel10deny-lists.Rationale:
Resolves: RHEL-250374
On RHEL 8,
ssh -Q macdoes not list it. Remediation that uses the default selector writes:MACs hmac-sha2-512-etm@openssh.com,...,hmac-sha2-256,hmac-ripemd160sshd then fails with
Bad SSH2 mac specand does not start.cis_rhel8/9/10stay deny-lists (leading-). Only unimplementedripemd names are removed. This is not an allow-list conversion.
SLE12 update SSH Strong MACs #14447 fixed SLE only (
cis_sle12). RHELdefaultwas left unchanged.[SSH] Remove hmac-ripemd160 from sshd_strong_macs default and cis_sle12 selectors #14460 attempted a default-value fix but was closed unmerged.
Review Hints:
linux_os/guide/services/ssh/sshd_strong_macs.varsshd -tsucceeds with the new default and new cis_rhel8 listhmac-ripemd160in the affected selectors.